Add specs and fix logic

Prior to this there were cases where the timeout did not behave as expected. All tests now pass.

sadly this code is super error prone. in particular, errant values in the HTTP_X_REQUEST_START header can result in a negative `time_left`, which is why this logic needs to stay here :crying_cat_face: